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Executive summary 


Cyber troops are government, military or political party teams committed to manipulating 
public opinion over social media. In this working paper, we report on specific organizations 
created, often with public money, to help define and manage what is in the best interest of the 
public. We compare such organizations across 28 countries, and inventory them according to 
the kinds of messages, valences and communication strategies used. We catalogue their 
organizational forms and evaluate their capacities in terms of budgets and staffing. This working 
paper summarizes the findings of the first comprehensive inventory of the major organizations 
behind social media manipulation. 


We find that cyber troops are a pervasive and global phenomenon. Many different countries 
employ significant numbers of people and resources to manage and manipulate public opinion 
online, sometimes targeting domestic audiences and sometimes targeting foreign publics. 


e The earliest reports of organized social media manipulation emerged in 2010, and by 
2017 there are details on such organizations in 28 countries. 

e Looking across the 28 countries, every authoritarian regime has social media campaigns 
targeting their own populations, while only a few of them target foreign publics. In 
contrast, almost every democracy in this sample has organized social media campaigns 
that target foreign publics, while political-party-supported campaigns target domestic 
voters. 

e Authoritarian regimes are not the only or even the best at organized social media 
manipulation. The earliest reports of government involvement in nudging public opinion 
involve democracies, and new innovations in political communication technologies often 
come from political parties and arise during high-profile elections. 

e Over time, the primary mode for organizing cyber troops has gone from involving 
military units that experiment with manipulating public opinion over social media 
networks to strategic communication firms that take contracts from governments for 
social media campaigns. 


Social media and democracy 


Social media has become a valuable platform for public life. It is the primary medium over which 
young people, around the world, develop their political identities and consume news. However, 
social media platforms—like Facebook and Twitter—have also become tools for social control. 
Many governments now spend significant resources and employ large numbers of people to 
generate content, direct opinion and engage with both foreign and domestic audiences. This 
working paper lays the groundwork for understanding the global trends in the organized and 
coordinated use of social media for manipulating public opinion. 


In this paper we define cyber troops as government, military or political-party teams committed 
to manipulating public opinion over social media. Given that little is known about the differences 
in capacity, tools and techniques of these practices in different countries, we conducted a cross- 
national and comparative study of global cyber troops. Examining social media operations in 25 
countries, we have undertaken an inventory of budget expenditures, staffing, organizational 
behavior and communication strategies to analyses the size, scale and extent to which different 
kinds of political regimes deploy cyber troops to influence and manipulate the public online. 


In January 2015, the British Army announced that its 77th Brigade would “focus on non-lethal 
psychological operations using social networks like Facebook and Twitter to fight enemies by 
gaining control of the narrative in the information age” (Solon, 2015). The primary task of this 
unit is to shape public behavior through the use of “dynamic narratives” to combat the political 
propaganda disseminated by terrorist organizations. The United Kingdom is not alone in 
allocating troops and funding for influencing online political discourse. Instead, this is part of a 
larger phenomenon whereby governments are turning to Internet platforms to exert influence 
over information flows and communication channels to shape public opinion. We compare and 
summarize this phenomenon in the following 28 countries: Argentina, Azerbaijan, Australia, 
Bahrain, Brazil, China, the Czech Republic, Ecuador, Germany, India, Iran, Israel, Mexico, North 
Korea, the Philippines, Poland, Russia, Saudi Arabia, Serbia, South Korea, Syria, Taiwan, Turkey, 
Ukraine, the United Kingdom, the United States, Venezuela and Vietnam. 


In terms of scope, there are several things we do not investigate. First, although cyber troops 
will often apply traditional offensive cyber tactics, such as hacking or surveillance, to target users 
for trolling or harassment campaigns, this is not a working paper about hackers or other 
cybersecurity professionals who work in a governmental capacity. An important distinction 
between cyber troops and other state-based actors operating in cyberspace is their role in 
actively shaping public opinion. Second, there are many countries that have no domestic 
organizations for social media manipulation, but participate in multilateral mutual defense pacts 
with programs for doing so. For example, NATO has an accredited international military 


organization called the NATO Strategic Communication Center of Excellence with a list of 
sponsoring nations, not all of which are in the inventory we present here. Informal civil society 
organizations that use social media in a coordinated way are not included in this analytical 
frame, nor are private firms and industrial associations with organized campaigns to manipulate 
public opinion. 


Methodology 


We conducted the research for this working paper in three stages. First, we conducted a 
systematic content analysis of news media articles. Second, we supplemented the content 
analysis with other sources from think tanks, government agencies, civil society groups, 
universities and other sources of credible research. Finally, we consulted with country experts to 
check facts, find additional sources in multiple languages and assist in evaluating the quality of 
sources. This methodology allowed us to purposefully select the cases for comparison, draw 
widely from existing research and engage with country and region experts for points of 
clarification. 


Content analysis is an established research method in communication and media studies 
(Herring, 2009). It has been used to help understand how the Internet and social media interact 
with political action, regime transformation and digital control (Strange et al., 2013; Joyce et al., 
2013; Edwards, 2013; Woolley, 2016). This qualitative content analysis was conducted to 
understand the range of state actors who actively use social media to manipulate public opinion, 
as well as their capacity, strategies and resources. We modelled our analysis after Joyce et al. 
(2013), Edwards et al. (2013) and Woolley (2016), who conducted a qualitative content analysis 
using purposive sampling to build a coded spreadsheet of specific variables that appear in news 
articles. Our coded spreadsheet includes fields such as the size of the government teams, their 
organizational structure and place within government, strategies and tools, skills and training, 
and capacity and resources. We purposively selected the following keywords and used them in 
combination for our search: astroturf*; bot; Facebook; fake; fake account; government; 
information warfare; intelligent agent; military; persona management; pro-government; 
propaganda; psychological operations; psyops; social media; sock puppet; troll*; Twitter. 


Media bias is a significant concern when conducting a content analysis that uses purposive 
sampling (Earl, 2004; Joyce et al., 2013). To mitigate any biases in the preliminary content 
analysis, we used LexisNexis and the top three search engine providers—Google, Yahoo! and 
Bing—which provided hits to a variety of professional and amateur news sources. A total of 104 
news stories were identified. We then ranked the articles based on their credibility using a similar 
ranking system to the one employed by Joyce et al. (2013) and Woolley (2016). The articles were 
scored on a three-point scale, with three being the most credible and one being the least 


credible. Articles ranked at three came from major, professionally branded news organizations, 
including: ABC News, BBC News, Reuters, The Economist, The Guardian, The Independent, The 
Mirror, The New York Times, The Telegraph, The Wall Street Journal, The Washington Post and 
Wired Magazine. Articles ranked at two came from smaller professional news organizations, or 
commentary-oriented websites or expert blogs. These included websites such as: Al-Monitor, 
Buzzfeed, Freedom House, Human Rights Watch, Medium, The New Republic, The New Statesman, 
The Observer, Quartz, The Register, The Atlantic, The Daily Dot, The Hill, The Intercept, and The 
Verge. Articles ranked at one came from content farms, social media posts or personal or hyper- 
partisan blogs. These articles were removed from the sample. 


A total of 83 news articles made up the final sample, and from these we were able to extract 
several different kinds of variables. More importantly, we defined three domains of comparative 
analysis that allowed us to set individual country programs into a global context: (4) strategies, 
tools and techniques of social media manipulation; (2) organizational form; and (3) 
organizational budget, behavior and capacity. 


Assembling the existing corpus of public news reporting on the use of cyber troops around the 
world allowed us to establish cases of organized social media manipulation in 23 countries. We 
then moved to the corpus of more specialized working papers that have come out of think tanks, 
government agencies, civil society groups, universities and other sources of credible research. 
These reports yielded additional details on the known country comparison set, and provided 
additional evidence on cyber troop organization in two additional countries. 


One limitation to our methodology was that we only accessed news media articles and think 
tank reports in the English language. In order to address this limitation, we made additional 
queries with cybersecurity experts or people familiar with the political system in particular 
countries where needed. This final stage of consultation involved double-checking news reports, 
rather than adding new information off the record. We did not include any additional 
observations by country experts that could not be verified in publication elsewhere. 


We undertook additional research on additional countries where there is known trolling and 
automated political communication activity. If we found evidence of suspicious activity, but 
were unable to trace clear signs of organization behind the political communication campaign, 
the cases were dropped from the analysis. In other words, in this analysis we focus exclusively 
on organized social media campaigns that have the clear support of political parties and 
governments. Readers interested in those other countries where there is evidence of largely 
unorganized attempts at social media manipulation should consult some of our project's 
country-specific reports, for example on Canada (McKelvey and Dubois 2017). 


Finally, there are almost certainly cyber troop operations that have not been publicly 
documented, and it is likely that the case list will grow over time. But for the moment it is safe 
to conclude that there are significant social media manipulation programs in the 28 countries 
we analyze here. There are similarities on the relative strategies and organizational behavior of 


these cyber troops. 


|. Strategies, tools and techniques for social media 
manipulation 


Cyber troops use a variety of strategies, tools and techniques for social media manipulation. 
Generally speaking, teams have an overarching communications strategy that involves creating 
official government applications, websites or platforms for disseminating content; using 
accounts—either real, fake or automated—to interact with users on social media; or creating 
substantive content such as images, videos or blog posts. Teams also differ in the valence of 
their messages and interactions with users online. Valence is a term that is used to define the 
attractiveness (goodness) or averseness (badness) of a message, event or thing. Some teams 
use pro-government, positive or nationalistic language when engaging with the public online. 
Other teams will harass, troll or threaten users who express dissenting positions. The following 
section outlines in more detail the strategies, tools and techniques used for social media 
manipulation, and Table 1 summarizes the points of comparison across the country cases. 


Commenting on social media posts 

Cyber troops in almost every country in our sample actively engage with users by commenting 
on posts that are shared on social media platforms. The valence of these engagements differs 
across our sample. Some cyber troops focus on positive messages that reinforce or support the 
government's position or political ideology. Israel, for example, has a strict policy of engaging in 
positive interactions with individuals who hold positions that are critical the government (Stern- 
Hoffman, 2013). Negative interactions involve verbal abuse, harassment and so-called “trolling” 
against social media users who express criticism of the government. In many countries, cyber 
troops engage in these negative interactions with political dissidents. In connection with the 
government, Azerbaijan’s IRELI Youth have been known to post abusive comments on social 
media (Geybulla, 2016). And in Mexico, journalists are frequently targeted and harassed over 
social media by government-sponsored cyber troops (O’Carrol, 2017). 


However, the valence of comments is not always clearly positive or negative. Instead, some 
cyber troops will post neutral comments, designed to distract or divert attention from the issue 
being discussed. Saudi Arabia, for example, engages in “hashtag poisoning”, where cyber troops 
spam trending hashtags to disrupt criticism or other unwanted conversations through a flood of 
unrelated tweets (Freedom House, 2013). Other countries, such as the Czech Republic, post 
comments that are neither positive nor negative, but rather fact-check information (Faiola, 
2017). For the most part, the valence of commenting strategies does not occur in isolation: cyber 
troops will often use a mix of positive, negative and neutral posts when engaging with users on 
social media. This is best articulated by a member of the so-called “5o Cent Party”, so-called 
because of a rumor that government-sponsored Internet commentators were paid 50 cents 
every time they posted messages online. The informant noted that a common strategy is to 
post emotive comments online in order to generate directed citizen rage towards the 


commentator; thereby diverting criticism away from the government or political issue originally 
being discussed (Weiwei, 2012). 


Individual targeting 

Individual targeting is a cyber troop strategy that involves selecting an individual or group to 
influence on social media. In Poland, for example, opinion leaders, including prominent 
bloggers, journalists and activists, are carefully selected and targeted with messages in order to 
convince them that their followers hold certain beliefs and values (Gorwa 2017). Other, more 
popular forms of individual targeting involve harassment. Harassment generally involves verbal 
abuse, hate speech, discrimination and/or trolling against the values, beliefs or identity of a user 
or a group of users online. Individual targeting is different from negative valence posts on social 
media, as the harassment usually spans along duration. Sometimes, the harassment takes place 
during important political events, such as elections. For example, in South Korea, employees 
from the National Intelligence Service launched a series of smear campaigns against South 
Korean opposition parties in the lead up to the 2012 presidential election (The Korean Herald, 
2013). More often, individual targeting is a persistent aspect of the Internet ecosystem that is 
used to silence political dissent online. It is also one of the most dangerous forms of cyber troop 
activity, as individuals often receive real-life threats and suffer reputational damage. In Russia, 
cyber troops have been known to target journalists and political dissidents. 


Following an investigation into a rising number of abusive pro-Russian posts on the Internet, 
Finnish Journalist Jessica Aro received a series of “abusive emails, was vilified as a drug dealer 
on social media, and mocked as a delusional bimbo in a music video posted to YouTube” 
(Higgins, 2016). In Azerbaijan, individuals are frequently targeted on Twitter and other social 
media platforms if they criticize the government (Geybulla, 2016). The trolling activities of 
Azerbaijan’s IRELI Youth have even been shown to dissuade regular Internet users from 
supporting political protest and engaging in political discussions online (Pearce & Kendzior, 
2012). Some cyber troop teams have a highly coordinated system for identifying and targeting 
individuals. In Turkey, ringleaders will post a screenshot of an oppositional account so that 
others can launch a smear campaign against that individual (Sozeri, 2015). In Ecuador, individual 
targeting is coordinated through the government using the web-based platform Somos + 
(Morla, 2015a). And in Russia, leaders of the Kremlin-aligned Nashi Youth Movement have sent 
around a list of human rights activists, declaring them “the most vile of enemies” (Elder, 2012). 


Government-sponsored accounts, web pages or applications 

Some countries run their own government-sponsored accounts, websites and applications 
designed to spread political propaganda. These accounts and the content that comes out of 
them are clearly marked as government operated. In the United Kingdom, for example, the 77th 
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Brigade maintains a small presence on Facebook and Twitter under its own name (Corfield, 
2017). Other countries are much more active in an official capacity. Israel has more than 350 
official government social media accounts, covering the full range of online platforms, from 
Twitter to Instagram, and operating in three languages: Hebrew, Arabic and English 
(Benedictus, 2016). 


But it is not just social media platforms where cyber troops are active. In addition, there are a 
wide range of online platforms and applications that governments make use of to spread 
political propaganda or silence political dissent, including blogs, mobile applications and official 
government web pages. Sometimes these online resources help volunteers or other citizens 
retweet, share and like government-sponsored content. Ukraine’s i-Army, also known as “the 
army of truth”, operates a website where citizens and volunteers can access and share “truthful” 
information on social media (Benedictus, 2016). In other cases, government-sponsored online 
resources can be used to galvanize pro-government supporters. In Ecuador, the government 
launched a website called Somos + to investigate and respond to social media users who criticize 
the government. The website sends updates to subscribers when a social media user criticizes 
the government, allowing pro-government supporters to collectively target political dissidents 
(Morla, 2015 a). 


Fake accounts and computational propaganda 

In addition to official government accounts, many cyber troop teams run fake accounts to mask 
their identity and interests. This phenomenon has sometimes been referred to as “astroturfing”, 
whereby the identity of a sponsor or organization is made to appear as grassroots activism 
(Howard, 2003). In many cases, these fake accounts are “bots’”—or bits of code designed to 
interact with and mimic human users. According to media reports, bots have been deployed by 
government actors in Argentina (Rueda, 2012), Azerbaijan (Geybulla, 2016), Iran (BBC News, 
2016), Mexico (O’Carrol, 2017), the Philippines (Williams S, 2017), Russia (Duncan, 2016), Saudi 
Arabia (Freedom House, 2013), South Korea (Sang-Hun, 2013), Syria (York, 2011), Turkey 
(Shearlaw, 2016) and Venezuela (VOA News, 2015). These bots are often used to flood social 
media networks with spam and fake news. They can also amplify marginal voices and ideas by 
inflating the number of likes, shares and retweets they receive, creating an artificial sense of 
popularity, momentum or relevance. Not all governments make use of this form of automation. 


In Serbia, for example, a handful of dedicated employees run fake accounts to bring attention 
to the government's agenda (Rujevic, 2017). Similarly, in Vietnam, pro-government bloggers are 
responsible for spreading the party line (Pham, 2013). Some commentators have suggested that 
the use of human-run accounts could be due to a lack of technical sophistication (Rujevic, 2017). 
But as bots become increasingly political, social media platforms have become stricter in their 
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take-down policies. As a result, many people have gone back to operating the accounts 
themselves, rather than automating them. For example, in Mexico, when many of the 
government-sponsored spam-bots that were used to target journalists and spread 
disinformation on social media were blocked, human agents went back to operating the 
accounts themselves (O’Carrol, 2017). Increasingly, cyber troops are using a blend of automation 
and human interaction. These so-called “cyborgs” are deployed to help avoid detection and 
make interactions feel more genuine. Finally, it is important to note that not all cyber troops use 
“fake accounts”. North Korea is an interesting case, where stolen South Korean accounts—as 
opposed to fake identities—are used to spread political propaganda (Benedictus, 2016). 


Content creation 

Some cyber troop teams create substantive content to spread political messages. This content 
creation amounts to more than just a comment on a blog or social media feed, but instead 
includes the creation of content such as blog posts, YouTube videos, fake news stories, pictures 
or memes that help promote the government's political agenda. In the United Kingdom, cyber 
troops have been known to create and upload YouTube videos that “contain persuasive 
messages” under online aliases (Benedictus, 2016). Some of these “psychological operations”, 
or psyops, have been framed as “anti-radicalization” campaigns designed to deter British 
Muslims from going to Syria (Williams, 2015). In Russia, some cyber troops create appealing 
online personas and run blogs on websites such as LiveJournal. According to Chen’s (2015) story, 
one Russian cyber trooper ran a fortune-telling blog that provided insight into “relationships, 
weight loss, Feng Shui—and, occasionally, geopolitics”, with the goal of “weaving propaganda 
seamlessly into what appeared to be the non-political musings of an everyday person”. 
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Table 1: Strategies, tools and techniques for social media manipulation 


Country 


Messaging and valence 


Social media 


Fake accounts 


Communication strategy 


Government 


Content creation 


Individual targeting 


comments 


websites, accounts 


or applications 


Argentina 
Australia 
Azerbaijan 
Bahrain 
Brazil 


China 

Czech Republic 
Ecuador 
Germany 

India 

Iran 

Israel 

Mexico 


North Korea 
Poland 
Philippines 
Russia 

Saudi Arabia 
Serbia 

South Korea 
Syria 

Taiwan 
Turkey 
United Kingdom 
Ukraine 
United States 


Venezuela 
Vietnam 


+ 


Evidence found 


Evidence found 
Evidence Found 
Evidence found 


Evidence found 
Evidence found 


Evidence found 


Evidence Found 
Evidence found 
Evidence found 


Evidence found 
Evidence found 
Evidence found 
Evidence found 
Evidence found 


Automated 
Automated 
Automated 
Automated, Human 
Automated, Human, 
Cyborg 
Human 


Automated, Human 
Automated 


Automated 


Automated, Human, 
Cyborg 
Human 
Human 

Automated 
Automated, Human 
Automated 
Human 
Automated, Human 
Automated 
Cyborg, Human 

Automated, Human 
Human 
Human 

Automated, Human, 
Cyborg 

Automated, Human 
Human 


Evidence found 
Evidence found 


Evidence found 


Evidence found 
Evidence found 
Evidence found 
Evidence found 


Evidence found 


Evidence found 
Evidence found 
Evidence found 
Evidence found 
Evidence found 


Evidence found 
Evidence found 


Evidence found 


Evidence found 
Evidence found 


Evidence found 


Evidence found 


Source: Authors’ evaluations based on data collected 2010-2017. 
Note: This table reports on automated and trolling political activity, even if not clearly associated with a sponsoring 


organization. For social media comments: + = pro-government or nationalistic comments, - = harassment, trolling 


or negative interactions with users, n= distracting or changing the topic of discussion, or fact-checking information. 


No information noted with ™..”. 
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Il. Organizational forms 


Cyber troops are often made up of an assortment of different actors. In some cases, 
governments have their own in-house teams that are employed as public servants. In other 
cases, talent is outsourced to private contractors or volunteers. See Table 2 for a summary of 
the findings reported in this section. 


Government 

Government-based cyber troops are public servants tasked with influencing public opinion. 
These individuals are directly employed by the state as civil servants, and often form a small part 
of a larger government administration. Within the government, cyber troops can work within a 
government ministry, such as in Vietnam, in Hanoi Propaganda and Education Department 
(Pham, 2013), or in Venezuela, in the Communication Ministry (VOA News, 2016). In the United 
Kingdom, cyber troops can be found across a variety of government ministries and functions, 
including the military (77th Brigade) and electronic communications (GCHQ) (Greenwald, 2014¢; 
MacAskill, 2015). And in China, the public administration behind cyber troop activities is 
incredibly vast. There are many local offices that coordinate with their regional and national 
counterparts to create and disseminate a common narrative of events across the country 
(Weiwei, 2012). Other cyber troops are employed under the executive branch of government. 
For example, in Argentina and Ecuador, cyber troop activities have been linked to the office of 
the President (Rueda, 2012; Morla, 2015a, 2015). 


Politicians and parties 

Political parties or candidates often use social media as part of a broader campaign strategy. 
Here we are interested in political parties or candidates that use social media to manipulate 
public opinion during a campaign, either by purposefully spreading fake news or disinformation, 
or by trolling or targeting any support for the opposition party. This is different to traditional 
digital campaign strategies, which have generally focused on spreading information about the 
party or candidate’s platform, or sent advertisements out to voters. 


Social media is used by political parties to manipulate the public is to use fake accounts to 
artificially inflate the number of followers, likes, shares or retweets a candidate receives, 
creating a false sense of popularity. This was a technique that the Australian Coalition party used 
during its campaign in 2013 (Peel, 2013). Sometimes, when political parties or candidates use 
social media manipulation as part of their campaign strategy, these tactics are continued when 
they assume power. For example, in the Philippines, many of the so-called “keyboard trolls” 
hired to spread propaganda for presidential candidate Duterte during the election continue to 
spread and amplify messages in support of his policies now he’s in power (Williams, 2017). 
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Private contractors 

In some cases, cyber troops are private contractors hired by the government. Private contractors 
are usually temporary, and are assigned to help with a particular mission or cause. For example, 
the United States government hired a public relations firm to develop a persona management 
tool to develop and manage fake profiles on social media (Monbiot, 2011). Of course, the 
boundary between a private contractor and the state is not always very clear. In Russia, the 
Internet Research Agency, a private company, is known to coordinate some of the Kremlin’s 
social media campaigns (Chen, 2015; Benedictus, 2016). 


Volunteers 

Some cyber troops are volunteer groups that actively work to spread political messages on social 
media. They are not just people who believe in the message and share their ideals on social 
media. Instead, volunteers are individuals who actively collaborate with government partners to 
spread political ideology or pro-government messages. In many cases, volunteer groups are 
made up solely of youth advocacy organizations, such as IRELI in Azerbaijan (Geybulla, 2016) or 
Nashi in Russia (Elder, 2012). In Israel, the government actively works with student volunteers 
from Jewish organizations or other pro-Israel groups around the world (Stern-Hoffman, 2013). 
These cyber troops are considered “volunteers” because they are not on a formal payroll, as a 
public servant or private contractor would be. In many cases, however, volunteers receive other 
rewards for their time. For example, in Israel, the top-performing students are awarded 
scholarships for their work (Stern-Hoffman, 2013), and in Azerbaijan, volunteer work with IRELI 
is considered a stepping-stone to more senior roles in public administration (Geybulla, 2016). 


Paid citizens 

Some cyber troops are citizens who are actively recruited by the government and are paid or 
remunerated in some way for their work. They are not official government employees working 
in public service, nor are they employees of a company contracted to work on a social media 
strategy. They are also not volunteers, because they are paid for their time and efforts in 
supporting a cyber troop campaign. Normally, these paid citizens are recruited because they 
hold a prominent position in society or online. In India, for example, citizens are actively 
recruited by cyber troop teams in order to help propagate political ideologies and messages 
(Kohlil, 2013). Since these citizens are not officially affiliated with the government or a political 
party, their “independent voice” can be used to help disseminate messages from a seemingly 
neutral perspective. 
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Table 2: Organizational forms 


Country 


Government 


Politicians and Parties 


Civil Society 


Citizens 


Private 
Contractor 


Number 
of Forms 


Argentina 


Australia 
Azerbaijan 


Bahrain 
Brazil 


China 


Czech 
Republic 
Germany 
Ecuador 


India 
Iran 
Israel 
Mexico 


North 
Korea 
Poland 
Philippines 


Russia 


Saudi 
Arabia 


Serbia 
South 
Korea 
Syria 
Taiwan 


Turkey 


United 
Kingdom 
Ukraine 
United 
States 


Venezuela 
Vietnam 


Ministry of Communication 
President's Office 


National Cyber Crime Unit 


State Internet Information Office, Ministry of 
Industry and Information Technology, 
Ministry of Public Security, Communist Party 
Centre Against Terrorism and Hybrid 
Threats 
Cyber-Kommando der Bundeswehr 
Ministry of Strategic Sectors 
President's Office 


Revolutionary Guard, Supreme Council of 
Cyberspace 
Israel Defence Force 
Prime Minister's Office 


United Front Department and 
Reconnaissance General Bureau 


GRU 
The Kremlin 


Ministry of Defense — The Saudi ideological 
Warfare Center 


Prime Minister's Office 
National Intelligence Service 


Syrian Electronic Army 


77th Brigade, GCHO 


Information Policy Ministry 
DARPA, US Cyber Command, US Agency for 
International Development, Air Force, 
Pentagon 
Communication Ministry 
Hanoi Propaganda and Education 
Department 


Republican Proposal Party 


The Coalition 


Brazilian Social Democracy Party 
(PSDB), Worker’s Party (PT) 


Alternative for Germany (AFD) 


Bharatiya Janata Party (BJP) 


Institutional Revolutionary Party 
(PRI) 


Evidence Found 
The Partido Demokratiko Pilipino- 
Lakas ng Bayan 


Serbian Progressive Party 


Democratic Progressive Party 
(DPP), Nationalist Party (KMT) 
Justice and Development Party 

(AKP) 


Democratic Party 
Republican Party 


IRELI, the IT 
Academy 


Israel Under Fire 


Evidence Found 


Nashi 


Saudi Electronic 
Army, Salmani 
Army 


Evidence Found 
Evidence Found 


Evidence Found 


Evidence 
Found 
Evidence 
Found 


Evidence 
Found 


Evidence 
Found 


Evidence 
Found 
Evidence 
Found 


Evidence 
Found 


Evidence 
Found 


Evidence 
Found 


Agencia Pepper 
/no.bot 


Ribeney, 
Percera and 
Ximah Digital 


Andreas 
Sepulveda 


Evidence Found 
Nic Gabunada 


Internet 
Research 
Agency 
Oorvis 


EGHNA 


Centcom, HB 
Gary 


Source: Authors’ evaluations based on data collected 2010-2017. Note: No information noted with “..”. 
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Ill. Organizational budget, behavior and capacity 


Cyber troop teams differ in their budgets, behaviors and capacity. Our study has found that team 
sizes range from a small team of less than 20 (e.g. in the Czech Republic) to a vast network of 
two million individuals working to promote the party line (e.g. in China). Table 3 presents 
comparative data on government capacity and estimated budgets. The budget column includes 
the best estimate of resources and how that money is allocated. The management column 
describes the organizational practices of the offices tasked with social media manipulation. 
These categories are described in further detail below. 


Budget information 

Cyber troops spend various amounts of funds on their operations. The amount of publicly 
available information on budgets and spending is relatively limited. Nevertheless, we are able to 
report on a few numbers. Most of the budgetary information highlighted in this section refers to 
contractual amounts for one operation, as opposed to an overall annual expenditure for staffing, 
technical equipment or other resources required. For example, Ecuador, which contracts out 
cyber troop activity to private firms, spends, on average, USD200,000 per contract (Morla, 
2015). EGHNA, which contracts out work for the Syrian government, notes that the usual project 
cost is about USD4,o00 (EGHNA, 2017). In a few cases, such as in Russia, there have been 
suggestions that military expenditures for social media manipulation operations have been 
increasing over the years (Sindelar, 2014). 


Organizational behavior 

We have identified several organizational practices of cyber troop teams: (1) a clear hierarchy 
and reporting structure; (2) content review by superiors; and (3) strong coordination across 
agencies or team; (4) weak coordination across agencies or teams; (5) liminal teams. In some 
cases, teams are highly structured with clearly assigned duties and a reporting hierarchy, much 
like the management of a company or typical government bureaucracy. Tasks are often 
delegated on a daily basis. In Russia and China, for example, cyber troops are often given a list 
of opinions or topics that are supposed to be discussed on a daily basis. These topics usually 
relate to a particular political issue that is taking place (Cook, 2011; Chen, 2015). As part of the 
reporting structure, managers or superiors will often review the work of the team. 


In Serbia, for example, cyber troops and their work are closely monitored and reviewed by 
managers and leaders (Rujevic, 2017). Sometimes there is more than one agency or team 
working on propaganda campaigns, such as in China, where propaganda offices exist at the local 
levels of government. Here, each of these offices focuses on local issues, but also coordinates 
broader messages across the country depending on the domestic political issues being discussed 
at the time (Weiwei, 2012; Lam, 2013). In other cases, teams are less organized, structured, 
supervised, and coordinated. For example, the Saudi Electronic Army and the Salmani Army 
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have several members conducting campaigns on social media. These teams are often less 
coordinated and less formal than other cyber troop teams, but nonetheless have effects on the 
social media environment (Hussein 2017). 


Capacity building 

Cyber troops will often engage in capacity-building activities. These include: (2) training staff to 
improve skills and abilities associated with producing and disseminating propaganda; (2) 
providing rewards or incentives for high-performing individuals; and (3) investing in research and 
development projects. When it comes to training staff, governments will offer classes, tutorials 
or even summer camps to help prepare cyber troops for engaging with users on social media. In 
Russia, English teachers are hired to teach proper grammar for when they communicate with 
Western audiences (Seddon, 2014). Other training measures focus on “politology”, which aims 
to outline the Russian perspective on current events (Chen, 2015). In Azerbaijan, young people 
are provided with blogging and social media training to help make their microblogging websites 
more effective at reaching desired audiences. Reward systems are sometimes developed to 
encourage cyber troops to disseminate more messages. For example, in Israel, the government 
provides students with scholarships for their work on pro-Israel social media campaigns (Stern- 
Hoffman, 2013). It is important to note that training and reward programs often occur together. 
In North Korea, for example, young computer experts are trained by the government, and top 
performers are selected to join the military university (Firn, 2013). Finally, some cyber troops in 
some democracies are investing in research and development in areas such as “network effects” 
and how messages can spread and amplify across social media. For example, in the United 
States, in 2010, DARPA funded a USD8.9 million study to see how social media could be used to 
influence people’s behavior by tracking how they responded to content online (Quinn and Ball, 
2014). 
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Table 3: Organizational budget, behavior and capacity 


Country 


Year of 
earliest 


Budget information 


(USD) 


Organizational behavior 


report 


Argentina 
Australia 
Azerbaijan 


Bahrain 
Brazil 


China 


Czech Republic 
Ecuador 


Germany 
India 

Iran 

Israel 
Mexico 
North Korea 


Poland 


Philippines 


Russia 


Saudi Arabia 
Serbia 
South Korea 
Syria 


Taiwan 
Turkey 


United Kingdom 
Ukraine 
United States 


Venezuela 
Vietnam 


2012 
2013 
2011 


2013 
2010 


2011 


2017 
2014 


2016 
2013 
2012 
2013 
2017 
2013 


2015 


2016 


2012 


2013 


2017 


2013 


2011 


2010 
2013 


2014 
2015 
2011 


2015 
2013 


3m 


Multiple contracts to 
private companies, 
estimated at 200,000 


600,000 


200,000 


10m 


4,000 per contract with 
EGHNA 


Multiple programs, one 
valued at 209,000 


Multiple programs, valued 
at 2.7m, 42m and 8.9m 


Clear hierarchy and reporting 
structure, coordination across 
agencies 


Clear hierarchy and reporting 
structure, coordination across 
agencies, integrated with 
campaign and party organization 
Clear hierarchy and reporting 
structure, coordination across 
agencies 
Coordination across agencies 


Informal, liminal teams 


Some coordination across teams 


Liminal membership, but some 
coordination across teams 
Clear hierarchy and reporting 
structure, content is reviewed by 
superiors, coordination across 
agencies 
Liminal membership, less 
coordinated across teams. 
Clear hierarchy and reporting 
structure, coordination across 
agencies 


Liminal membership 


Highly coordinated teams 


Staff Capacity building 
capacity 
35-40 
50,000 Training is 
provided 
Extended use, 
beyond election 
day 
2,000,000 Training is 
provided, reward 
system 
20 
<300 
20,000 fe 
400 Reward system 
limited 
200 Training is 
provided, reward 
system 
Training is 
provided 
400-500 
400 Training is 
provided 
<20 
6,000 Training is 
provided 
1,500 
20,000 = 
Invests in 
Research and 
Development 
1,000 5 


Source: Authors’ evaluations based on d 


report. No information noted with “..”. 


ata collected 2010-2017. Note: All currency values in USD from year of 
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Conclusion 

There is no doubt that individual social media users can spread hate speech, troll other users, or 
set up automated political communication campaigns. Unfortunately, this is also an organized 
phenomenon, with major governments and political parties dedicating significant resources 
towards the use of social media for public opinion manipulation. 


Figure 1 is a country heat map of cyber troop capacity, defined by the number of different 
organizational types involved. In many countries, political actors have no reported ability to field 
social media campaigns. In some countries, one or two known political actors occasionally use 
social media for political messaging, and in a few other countries there are multiple government 
agencies, political parties, or civil society groups organizing trolling and fake news campaigns. 


Figure 1: Organizational density of cyber troops, 2017 


Cyber Troop Density 
1) One 


In this figure, countries with many kinds of organizations (governments, political parties, civil 
society groups, organized citizens, or independent contractors) are in darker shades of red. Data 
is taken from the far right column of Table 2, and this figure reveals which countries have 
multiple kinds of actors, all using organized social media campaigns, to battle for public opinion. 


Organized social media manipulation occurs in many countries around the world. In 
authoritarian regimes it tends to be the government that funds and coordinates propaganda 
campaigns on social media. In democracies, it tends to be the political parties that are the 


primary organizers of social media manipulation. 
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In many countries, cyber troops have multiple affiliations, funders, or clients. So while the 
primary organizers of social media manipulation may be government agencies or political 
parties, it is also important to distinguish those countries where many kinds of actors make use 
of cyber troops. No doubt the organization of cyber troops will continue to evolve. It will likely remain, 
however, a global phenomenon. 
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